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Abstract 

In this paper, we study a security problem on a simple wiretap network, consisting of a source node S, a destination node D, 
and an intermediate node R. The intermediate node connects the source and the destination nodes via a set of noiseless parallel 
channels, with sizes ni and n 2 , respectively. A message M is to be sent from S to D. The information in the network may be 
eavesdropped by a set of wiretappers. The wiretappers cannot communicate with one another. Each wiretapper can access a subset 
of channels, called a wiretap set. All the chosen wiretap sets form a wiretap pattern. A random key K is generated at S and a coding 
scheme on (M, K) is employed to protect M. We dehne two decoding classes at D: In Class-I, only M is required to be recovered 
and in Class-II, both M and K are required to be recovered. The objective is to minimize H{K)/H{M) for a given wiretap 
pattern under the perfect secrecy constraint. The first question we address is whether routing is optimal on this simple network. 

By enumerating all the wiretap patterns on the Class-I/II (3, 3) networks and harnessing the power of Shannon-type inequalities, 
we find that gaps exist between the bounds implied by routing and the bounds implied by Shannon-type inequalities for a small 
fraction (< 2%) of all the wiretap patterns. The second question we investigate is the following: What is min H(K)/H(M) for 
the remaining wiretap patterns where gaps exist? We study some simple wiretap patterns and find that their Shannon bounds (i.e., 
the lower bound induced by Shannon-type inequalities) can be achieved by linear codes, which means routing is not sufficient 
even for the (3, 3) network. For some complicated wiretap patterns, we study the structures of linear coding schemes under the 
assumption that they can achieve the corresponding Shannon bounds. The study indicates that the determination of the entropic 
region of 6 linear vector spaces cannot be sidestepped. Some subtle issues on the network models are discussed and interesting 
observations are stated. 


Index Terms 

Network coding, linear network coding, entropic region, cut-set bound, routing bound. Shannon bound, wiretap network. 


I. Introduction 



Fig. 1. The communication model with three nodes and six noiseless channels 


A. A Security Problem on a Simple Communication Network 

In this paper, we study a security problem on a communication network (depicted in Fig. [Til with three nodes S, R, and D, 
where S is the source node, R is the intermediate node, and D is the destination node, respectively. There are three noiseless 
channels connecting the pairs (S, R) and (R, D). 

A private message M is generated at S and is to be sent to D. As there is a collection of wiretappers that can only tap 
the information on a subset of the channels, a random key K which is independent of M is also generated at node S. To 
protect the message M, a coding scheme whose encoders take as inputs both M and K is employed to combat the effect of 
the wiretappers. This coding scheme ensures that the information read by each wiretapper is independent of M. Furthermore, 
wiretappers cannot communicate with one another. For each wiretapper, the set of channels it accesses, called a wiretap set, 
is fixed before the coding scheme on (M, K) is constructed. The set of all the wiretap sets is called a wiretap pattern. Now, 
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a fundamental question arises: If we fix the size of the message, what is the minimum size of the key should be injected to 
protect the message? Here the “size” of a random variable is measured by its entropy. The problem we stated does not seem to 
be very hard since the network topology is simple and a simpler version of this problem dates back to Shannon 0. However, 
as we shall show in this paper, this problem appears to be hendishly hard. Even for such a simple network, the problem is 
challenging to solve completely. 


B. Related Results 

1) Network Coding: We leverage two important concepts in this paper, namely, routing and network coding. In most 
communication networks, information is transmitted in a store-and-forward manner; i.e., bits are delivered as commodities 
and then are routed from a node to another. The bits are unaltered on the transmission paths. Ahlswede et al. (H] proposed 
a network communication paradigm called network coding, where the role of the intermediate nodes is enhanced as follows. 
At each intermediate node, the information received on the input channels may be encoded, and may be sent on the output 
channels. Network coding can increase the achievable rates and even attain the capacity of the network. In 111], the classical 
max-flow-min-cut theorem is generalized to multicast scenario. Furthermore, the authors demonstrated that network coding 
can outperform store-and-forward in terms of bandwidth utilization. Routing is a class of special network coding schemes. 
Indeed, when network coding is used, the information is coded in the network. We refer the reader to Yeung et al. |2] for a 
comprehensive treatment of network coding theory. 

2) Mormation-Theoretic Security and Wiretap Networks: Information-theoretic security was launched in Shannon’s seminal 
work 1^, where the communication model is only a single channel. A key K is stored at the sender and receiver before the 
message M is sent. The sender generates X from M and K by an encoding function. Then X is sent through the channel. The 
receiver decodes M from X and K. The main result, called the perfect secrecy theorem, implies that the size of K (measured 
by its entropy) is lower bounded by the size of M. 

In wiretap networks, Cai and Yeung considered sending a private message to possibly more than one receiver through a 
noiseless communication network. Their model is as follows: The communication may be eavesdropped by a set of wiretappers, 
who cannot communicate with one another. Each of the wiretappers can access a subset of channels of the network, called 
a wiretap set. The wiretapper can choose an arbitrary wiretap set before communication and the choice is fixed during 
communication. The set of all the chosen wiretap sets is commonly referred to as a wiretap pattern, denoted by A. For such an 
A, the sender and the legitimate users have to design a coding scheme to combat the effect of the wiretappers. The strategy is 
to generate a random key K to protect the message and send both the message and the key via a network coding scheme. This 
ensures that a wiretapper can only observe some functions of the message and the key, where the output of the functions are 
statistically independent of the message. On the other hand, a receiver node can recover the private message by decoding the 
information received from its input channels. The performance of a secure network coding scheme is measured by the sizes of 
the message and the key. In designing a secure network coding scheme, the aim is to maximize the size of the message whist 
minimizing the size of the key. In yl), when A consists of all subsets of channels whose sizes are at most some constant r, 
there exists a linear network code which is optimal in both the sizes of the message and the key. When A is arbitrary, a cut-set 
bound on the ratio of the size of the key and the size of the message was obtained in Cheng and Yeung US. The wiretap 
network model is a generalization of the well known perfect secrecy system studied by Shannon fl, and is also widely studied 
from many different per^ectives. A comprehensive survey of the fundamental performance limits in wiretap networks can be 
found in Cai and Chan 171] . 

From the point of view of equivalence and complexity, Cui et al. 1^ showed that determining the secrecy capacity is an 
NP-hard problem for nonuniform or restricted wiretap sets. Huang et al. EH studied the problem where network nodes can 
independently generate randomness and the wiretap sets are uniform, showing that determining the secrecy capacity is at least 
as difficult as the fc-unicast network coding problem. More results on equivalence of network coding problems can be found 
in Huang et al. 12211 . We emphasize that the focus of this paper is not on determining the secrecy capacity; rather we are 
concerned with finding the minimum key size relative to the message length, i.e., H(K) / H(M). Thus, we avoid the difficulties 
pointed out in ll2d Bill : yet we encounter a different set of difficulties. 

3) Shannon- and non-Shannon-type Inequalities: The properties of Shannon information measures form a useful set of tools 
to investigate the properties of wiretap networks. For a set of random variables, the properties of information measures such 
as entropy, mutual information, conditional entropy are well known. In particular, it is well known that the above information 
measures are non-negative. Information inequalities which can be implied by Shannon’s information measures are referred to 
as Shannon-type inequalities; e.g., the inequality H{Xi\X 2 ) < H{Xi). If only the Shannon-type inequalities are concerned, a 
one-to-one correspondence between information measures and set theory can be established in the so-called /-Measure theory 
by Yeung Isl Ch. 3], which only involves simple set theory operations; i.e., union, intersection, complement, and set difference. 
Moreover, the following fundamental result Ch. 14] was established for the information measures: 

Fet [n] = {1, 2,..., n}. Any Shannon’s information measures involving random variables Xi, X^, . ■., Xn can be expressed 
as the sum of the following two elemental forms: 

(i) H{Xi\X^n\-{i})A G [nj; 
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(ii) I{Xi-,Xj\XK), where i 7 ^ j and X C [n] - {i, j}. 

Note that all the information inequalities we studied are linear. If we regard these n+ ( 2 ) 2 "“^ elements as variables, then any 
information expression can be rewritten as a linear combination of them. This observation enables us to check the correctness 
of a Shannon-type inequality by transforming it into an equivalent linear program, which can be easily implemented in a 
computer program. ITIP iflOll and Xitip d are two widely used software packages based on this very principle, where the 
latter is an upgraded version of the former. When a certain information inequality and some constraints are supplied as inputs 
to the software program, it will inform the user whether the information inequality is a valid Shannon-type inequality. The 
latest extensions of ITIP may be found in Tian lll2|] and Ho et al. 11311 . 

It was a long-standing problem as to whether there exist inequalities involving information measures that cannot be directly 
implied by Shannon-type inequalities. This was before the seminal work by Zhang and Yeung ifT^ . where the first non- 
Shannon-type inequality was proved. All the information inequalities on n random variables characterize the so-called entropic 
region T* Igt]. Note that the /-Measure-based method is futile for proving non-Shannon-type inequalities. In Dougherty et al. 
ifl^ , the inequality in S was used to reduce the capacity bound in a communication network, indicating that Shannon-type 


inequalities are not always sufficient in practice. The general theory of non-Shannon-type inequalities is still in its infancy 
and relatively little progress has been achieved. So far, the problem has been addressed when the number of random variables 
n < 3. When all the random variables are in one-to-one correspondences with vector spaces, the problem has been settled for 
n < 5 in Dougherty et al. 0 . For the case n = 6 , Dougherty IIT^ showed that the number of different linear rank inequalities 
exceeds 1 million. The exact set of linear rank inequalities is still unknown. 

4) Network Coding meets Information Inequalities: In essence, network coding problems can be perfectly represented by the 
aforementioned information measures. We can use random variables to denote the information transmitted on the channels. The 
encoding and decoding process at each node can be dealt by information equalities. The performance bounds of network coding 
can be expressed via information inequalities. It was proved in Chan and Grant ifisl] that the general secure network coding 
problem on multi-source and multi-sink network is as hard as determining the exact entropic region. That is, the general secure 
network coding problem is hard to solve. Thus, we seek bounds. We may consider only Shannon-type inequalities to obtain a 
bound on a concrete problem by solving the corresponding linear program, or invoking some /-Measure-based softwares; e.g., 
ITIP or Xitip. In the sequel, we refer to the bound obtained by Shannon-type inequalities as the Shannon bound. However, the 
/-Measure-based method suffers from the drawback that the computational complexity is exponential in the number of random 
variables, which means it works well only for very few random variables. Fortunately, we may also consider the cut-set bound, 
which is a classic tool in analyzing the performance of network coding. In some situations, the cut-set bound is tight; e.g., the 
bound obtained in j^]. 


C. The Problem We Study and The Question We Ask 

Network coding trumps routing in many aspects of communication scenarios. However, routing is advantageous over network 
coding due to its lower complexity in encoding and decoding and it is easy to understand and analyze. In some simple networks, 
in lieu of network coding, routing can be shown to be sufficient. In the wiretap network, the only easily-computable bounds 
are the cut-set bound and Shannon bound. The cut-set bound is optimal for the point-to-point communication system. If we 
consider only routing in the network, we can transform the general network model to a point-to-point network, which means 
we can obtain a bound based on routing. Here we refer to it as the routing bound. For a point-to-point communication network, 
all these three bounds are tight; while for general networks, none of them is tight in general. The main motivation of this work 
is from the following fundamental question: 

Can we systematically assess the tightness of these bounds in a marginally more complex network compared to a 
point-to-point network? 


D. Main Contribution and Techniques 

In this paper, we assess the optimality of routing in the wiretap network with a simple topology (Fig.[TJ. Recall that in nil, 
the cut-set bound is tight for a point-to-point communication system. Beyond the cut-set bound, no further result has been 
known till date and it is not clear to what extent, the routing scheme is optimal. Our network model is more complex since 
there is an extra encoding node. It is interesting to deduce whether routing is optimal. In this paper, we use ITIP/Xitip to 
compare the routing bound, the cut-set bound, and the Shannon bound for different wiretap patterns. We find out that for some 
wiretap patterns, there are gaps between the routing bounds and the Shannon bounds. We pick some examples from these 
wiretap patterns with gaps, and construct coding schemes to achieve the Shannon bounds. Hence, one of the main takeaways 
is that the routing bound is not tight even in this simple network. For some concrete wiretap patterns where gaps exist, we 
discuss linear coding schemes to achieve the Shannon bounds. Furthermore, two different decoding classes are defined and the 
distinction between them is discussed. 

We summarize our key contributions in this paper: Firstly, we enumerate all the possible wiretap patterns and determine 
the wiretap patterns where gaps between Shannon bounds and routing bounds exist. Secondly, for some wiretap patterns, we 
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construct coding schemes to show that routing is not optimal. Lastly, we study some complex wiretap patterns and present 
linear coding scheme for these patterns. By doing so, we gain an intuitive understanding of why the Shannon bound is, in 
general, difficult to attain in this simple network. We make several interesting observations during the course of our numerical 
study. We also discuss some interesting problems inspired by the study. 

E. Paper Organization 

The paper is organized as follows. In Section In] the problem formulation is stated and some related results are discussed. 
In Section UlI-AI we explain how the experiments are conducted and discuss the results. From Section UlI-BI to Section UlI-EI 
we select some wiretap patterns to further validate our claims. In Section IIVI we study two hard wiretap patterns and the 
structures of linear coding schemes to achieve the Shannon bounds. We conclude the paper in Section |V] by summarizing our 
key contributions and stating directions for further work. 

II. Problem formulation 

The general problem formulation is described as follows (depicted in Fig. |2]i: 



Fig. 2. The general communication model 

1. The network consists of three nodes, the source node S, the intermediate node R, and the destination node D. There are 
noiseless directed edges (channels) connecting the pairs (S, R) and (R, D). Denote the set of channels by £. Let ni be the 
number of channels from S to R and 712 be the number of channels from R to D, respectively. To simplify our discussion, 
we assume that the capacity of each channel is much larger than the sum of information rates. 

2. Let A4 and iC be the finite alphabets of the message M and the key K, respectively. At the source node S, a pair of 
uniformly distributed message and private key (M, K) is generated, where M € Ai is the message and K € IC is the 
private key. It is assumed that M and K are statistically independent; i.e., 

I{M;K)=0. (1) 

3. Denote the information transmitted on the channels from S to R by ATi 1 , ATi 2 ,..., Xi n,j^. Then 

Xi,2,..., \M, K) = 0. (2) 

All the above Xi ^’s belong to the finite alphabets Xi/s for 1 < t < rii. 

4. Denote the information transmitted on the channels from R to D by X 2 p,X 2 g, ...,X 2 ^n 2 - Then 

i?(X2.1, X2,2, X2.„, |Xi.i, Xi,2, ..., = 0. (3) 

All the above X 2 /S belong to the finite alphabets X 2 /S for 1 < t < 712 - Note that when one designs a code for the 
network, s/he is allowed to not only design the random variables {{Xi i, X 2 j) : / = 1 , ..., ni,j = 1 , ..., 712 } but also 
their finite alphabets {{Xi i, ni,j = 1,..., 712 }. 

5. At the destination node D, we set two different decoding classes. The first is only M is needed to be decoded at D and 
the other is that both M and K are needed to be decoded at D. We refer to these two different models as Class-I (ni, 712 ) 
network and Class-II ( 711 , 712 ) network, respectively. Specifically, in Class-I, we have 

Lf(M|X2.i,X2.2,...,X2.„J =0; (4) 

and in Class-II, we have 

iT(M, X|X2,1, X2,2,X2,„J = 0. (5) 

6. There is a set of wiretappers, each of which can access an arbitrary subset of £. The choice of the set each wiretapper 
selects is fixed before communication commences and stays the same during the process of communication. Wiretappers 
cannot communicate with one another. The set of choices of the wiretappers is denote by .4 C 2^. In the sequel, A is 
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referred to as a wiretap pattern. The sender and receiver need to consider all A € A, simultaneously. For a set A G A, 
denote {Xg, e G A) hy Xa- In this model, perfect secrecy is required. To be concrete, 

I{M;Xa) = 0, VAgA (6) 

7. In this work, we are interested in minimizing H{K)/H{M), given the constraints above; i.e., we are interested in finding 

min for a given A^ (7) 

Specifically, if we fix the size of M, what is the minimal size of K to achieve perfect secrecy? 

The encoding and decoding functions at S, R, and D should abide by the conventions in network coding theory ||2l. Moreover, 


the secrecy constraints (|6|l should be satisfied. The encoder at the sender S is 



ni 

/s: 

(8) 

The encoder at node R is 

ni 77-2 

2—1 2—1 

(9) 

The decoder at node D is: 

772 



(Class-I) 

2^1 

(10) 

or 

712 

/ii ■W_X 2 ,i ^ M X 1C. (Class-II) 

(11) 

The Class-I model is a special case of the wiretap network introduced in In Class-I networks, the private key K may be 

operated on at the intermediate node R to potentially increase the message size whilst ensuring that the message is transmissible 
securely over the network. The Class-II model is applicable to the scenario where multiple messages are to be delivered to 
the receivers and some non-important messages are used to protect the remaining important ones. In our model, since we 
have removed the capacity constraints on the channels (capacities are assumed to be sufficiently large), it is interesting to 
understand the impact of the condition that K must be recovered at the destination. In particular, we ask whether there are any 
wiretap patterns for which min H{K)/H{M) is changed when the decoding requirements on K are different. The answer is, 
in general, yes. 

A. Cutset bound. Routing bound. Shannon bound 


First, we state the cut-set bound for 

an arbitrary A. 


Theorem 1 (10,01). Let W = {ei,e 2 , 

e„} be a cutset and A C 2^ be a wiretap pattern. Then 



H{K) ^ 1 

H{M) ^ / 

^ ^ max ^ Xi — 1 

2-1 

(12) 

where 

Xi <1, V A G A 

eiSA 

(13) 

and 

Xi > 0, 1 < i < n. 

(14) 


This cut-set bound can be interpreted as follows. Since the focus is on the ratio between H{K) and H{M), we may as well 
set H{K) to be 1. Let Xi be the information rate on channel (represented by edge) e^, 1 < i < n. Assume that the symbols 
on the channels are mutually independent, then the constraints (foT l mean that the size of the symbols in each wiretap set 
cannot exceed the size of the key. Furthermore, the cut-set bound is tight for a point-to-point network and its optimality can 
be achieved by a linear code. Flence, if we wish to know to what extent routing is optimal, we should consider a network with 
at least three nodes. The algorithm for computing the cut-set bound is described in Alg. 1. 

When routing is performed, information is transmitted from S to D without being modified or coded at R. Flowever, to 
protect the message, one needs to perform coding at S and decoding at D. Otherwise, if M is not coded along with K, then 

* In principle, “min” should be replaced by “inf”, since in general, the lower bound on H{K)/H{M) can be only attained by random variables with 
countably infinite alphabets, so the constraint set is not closed. For ease of expositions, we use “min” here and in the following. 
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Algorithm 1 Algorithm for computing the cut-set bound 

1 Denote the number of edges in the cut-set by n and the number of wiretap sets by d. Let Ahe a d x n matrix. 

2 If the ith wiretapper can access the jth edge, then A(i,j) = 1. Otherwise, A{i,j) = 0. 

n 

3 Let Id be the vector with all entries equal 1. Solve the linear program: max ^ — 1, s.t. Ax < ld,x > 0. The reciprocal 

2 — 1 

of the optimal value is the cut-set bound. 


M cannot be secure. Hence, we may assume there are ni x 712 paths/channels directly connecting S to D. Since information is 
unchanged in each path, a wiretapper who can access channel e will know the information on all the paths that pass through 
e. Hence we need to define a new point-to-point communication system (or cut-set) and the corresponding wiretap patterns. 
The cut-set W' = {e^ e'l 2 ) ^2}- corresponding wiretap pattern A! is constructed as follows: For each A ^ A, 

there is a corresponding A' e A! such that A' = {e' ^.(1 < k < 77,2) : ei^i G A} U {e^ ^(1 < k < ni) : e2j G A}. Then 
the routing bound can be computed by applying the cut-set bound on W' and A' . According to 10, Etl, if the cut-set bound is 
achieved, one can also recover K from the specified coding scheme. Thus routing bounds are also the same for both Class-I 
and Class-II (ni,n 2 ) networks. The algorithm is described in Alg. 2. 


Algorithm 2 Algorithm for computing the routing bound 

1 Denote the number of wiretap sets by d. For ease of discussion, use 1, 2,..., ni and 1, 2,..., 772 to index the edges in the 
two layers of the network. 

2 There are 77 = 771 x 772 paths in the routing scheme. All the paths are ordered as follows. If a path goes through the ith 
edge in layer 1 and jth edge in layer 2 of the network, then its index is (7 — 1) x 772 -f j. Let A be a d x 77 matrix. 

3 If the 7th wiretapper can access the jth path, then A(?, j) = 1. Otherwise, A{i,j) = 0. 

n 

4 Let Id be a vector with all entries equal 1. Solve the linear program: max Xi — 1, s.t. Aa; < Id, a; > 0. The reciprocal 

i=l 

of the optimal value is the routing bound. 


The idea of Shannon bound is from Yeung |0, Ch. 14], where the key principle is to transform the problem to a linear 
program in the two elemental forms; i.e., 

(i) 7T(X,|X[„]_{i}),7G [nj; 

(ii) I{Xi-,Xj\XK), where i j and K C [ 77 ] - { 7 , j}. 

The algorithm for computing Shannon bound has been already implemented in ITIP/Xitip. When we input all the constraints, 
ITIP/Xitip will tell us whether H{K) > cH{M) is true or false. After gradually adjusting c, the Shannon bound will be 
obtained. 

Intuitively, we may speculate that routing is optimal for many wiretap patterns. But it is not trivial to prove its optimality. 
For Class-I/II (2, 2) networks, we can check that routing is optimal. For general ( 771 , 772 ) networks, numerical experimentations 
by computer programs are preferred. For each wiretap pattern A, denote 


ta 


= min 


H{K) 

H{My 


(15) 


where the minimum is taken over all coding schemes (per Sec. [Hli. Recall that various bounds in the literature satisfy that: 


Cut-set bound < Shannon bound < ta < Linear Network Coding bound < Routing bound. (16) 

The linear network coding bound above is the bound when optimized over all linear network coding schemes. In principle, 
if any lower bounds match any upper bounds, then ta is determined. Otherwise, further investigations must be conducted 
on such wiretap patterns. In the following, we conduct computation-based experiments to study the optimality of routing in 
Class-I/II networks. 


III. On the sub-optimality of routing 

A. Experiment 

When using ITIP/Xitip to assess the optimality of routing on the Class-I/II ( 771 , 772 ) networks, we face the challenge of 
having to deal with an immense computational complexity. In Class-I/II ( 771 , 772 ) networks, since the wiretap pattern A is a 
subset of 2^, in essence, we need to exhaust the set of all possible wiretap patterns, whose size is 2^'^' =2^ Therefore, 
in principle, when rii -f 772 > 6, it is hard to enumerate all patterns. The other difficulty is from the computational complexity 
of ITIP/Xitip, because we need to solve a linear program with ("i+™2+2^2"i+"2 _j_ -f 2) variables. 

For a given wiretap pattern A, we may assume that no element is a subset of another element. In this manner, the number 
of different wiretap patterns for the Class-I/II ( 771 , 772 ) networks can be largely reduced. For a given set P, a set L C 2^ is 
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called an antichain if it satisfies that for all different vi and V 2 vi % V 2 and V 2 %v\. The number of antichains for 
a set with size n = 0,1, 2,is listed in Table |T] (see Sloane lll9|] ). In light of the computational complexity, n = ni + n 2 = Q 


— n — 

0 

1 

2 

3 

4 

5 

6 

7 

# 

2 

3 

6 

20 

168 

7,581 

7,828,354 

2,414,682,040,998 


TABLE I 

The number oe antichains 


is the limiting problem size for ITIP/Xitip based algorithm. In the following, we only focus on the symmetric case where 
rii = n2 = 3. 

After reducing the problem size, we design the algorithm in Alg. 3; 


Algorithm 3 Algorithm for assessing the tightness of the routing bound 

Generate all the possible wiretap patterns which are antichains. For each wiretap pattern, 

1. Compute the cut-set bounds on {S,R) and {R,D), respectively. Keep the larger one and denote it by li. 

2. Compute the routing bound on S ^ R ^ D. Denote it by ( 2 - 

3. If li equals I 2 , then the routing bound is tight. And hence Shannon bound is tight too. Proceed to Step 5. 

4. Compare I 2 with the Shannon bound in ITIP/Xitip. If these two bounds are equal, then routing is optimal; otherwise, 
there is a gap between routing bound and Shannon bound. 

5. Proceed to the next wiretap pattern. 


Steps 1 and 2 are used to reduce computational cost, since computing the cut-set bound is much faster than the Shannon 
bound. The experiment lasted for around 3^ days. We keep track of some records during the experiment. For almost 80% 
of the wiretap patterns, the cut-set bounds match the routing bounds. In the Class-I (3, 3) network, there are around 159, 258 
wiretap patterns (2% of all the wiretap patterns) where gaps between routing bounds and Shannon bounds are found. In the 
Class-II (3,3) network, there are around 32,472 wiretap patterns (0.4% of all the wiretap patterns) where gaps exist. 

When a gap is found between the routing bound and the Shannon bound, there are two cases; one is that the routing bound 
is not tight, and network coding is needed; the other is that Shannon-type inequalities are not sufficient, and non-Shannon-type 
inequalities should be used. Next, some wiretap patterns are analyzed to show that routing is not sufficient for the Class-I/II 
(3, 3) network, and network coding is necessary to achieve min H{K)/H{M). 

B. Simplification of search procedure 

In the following sections, we choose some wiretap patterns to demonstrate the advantage of coding over routing, and the 
distinction between the Class-I and Class-II networks. Since the problem size is small, we just use Xi,..., Xq and ei..., 65 
to denote the random variables and edges. For ease of verification, we provide with the code written in Xitip and Matlab 
in Q. 

From existing works of the literature, we do not know whether Shannon bound is tight or linear network coding is sufficient. 
However, since the network topology is simple, we may first assume that the Shannon bound is tight and linear network 
codes suffice to achieve the Shannon bound. As such, we attempt to construct such a linear network code. To the best of 
our knowledge, there is no systematic and well-established technique on how to achieve the Shannon bound. One possible 
method is to study the structure of the optimal solution resulting from the linear program of the Shannon bound, by which 
some properties about the coding scheme may be found. This approach suffers from the curse of high dimensionality of the 
optimal solution. Here we provide an alternative method. Note that if we add more constraints to a linear program of the form 

maxc^cc, s.t. Ax < 6, (17) 

the optimal value will not be increased. If the optimal value remains the same, then we can use these additional constraints to 
reduce the search space for an optimal solution. If we use this technique to study the Shannon bound, some properties about 
the coding scheme may be obtained. 

The first simple intuition is that if we add the following constrains into the linear programs, the Shannon bounds always 
remain the same: 

H{Xi,X 2,X3) = H{Xi) + H{X2) + HiXs) (18) 

HiX4,X5,Xe) = H{X4) + H{X5) + H{Xe) (19) 

That is the random variables on the same layer are constrained to be mutually independent. 

Another idea is based on the observation that for a coding scheme, the following holds: 

H{Xi,X5,Xe\Xi,X2,X3) = 0. 


( 20 ) 
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This relationship is rather general since the functional relationships between the random variables may be more precise; e.g., 
X 4 may be a function of Xi and X 2 , and X 3 is not involved in the coding. The exact functional relationships will be very 
helpful in the construction of a linear coding scheme. Our algorithm is as follows: For each Xi (4 < i < 6 ), enumerate all 
the possible functional relationships with the subsets of Xi, X2, X3. Then update the functional relationship and check by 
ITIP/Xitip to see whether the Shannon bound is unchanged. If so, then the functional relationship is valid and does not decrease 
the optimal value of the linear program. Here we state an example to illustrate our approach. 

Before doing so, let us comment about the alphabet of the underlying random variables. As we mentioned in the definition 
of the code (in Section HDl, we are allowed to choose the alphabets. To keep the design of the codes simple, the alphabets 
henceforth are kept fixed to be (for some g > 3) in the coding schemes we design. In the sequel, unless otherwise stated, 
all the alphabets are the finite field F^. 

Example 1 . In the Class-II (3,3) network (depicted in Fig. |7J, let A = {Ai, A2, A3, A4, A^}, where Ai = {62,64,65}, 
A2 = {62,63,66}, A3 = {61,65,66}, A4 = {61,63,64}, and A3 = {61,62,64,66}. The routing bound is equal to 4 . By the 
following constraints, the Shannon bound is equal to 3. 


I{M;K) = 0 

(21) 

H{X 4 ,X 2 ,X 3 \M, K) = 0 

(22) 

H{X4,X3,Xe\X4,X2,X3)=0 

(23) 

H{M,K\X4,X5,Xe)=0 

(24) 

I{M-X 2 ,X 4 ,X 3 )=Q 

(25) 

I{M;X2,X3,Xe)=0 

(26) 

/(M;Xi,X5,X6) =0 

(27) 

I{M; X4,X3,X4)=0 

(28) 

I{M-,Xi,X2,X4,Xe)=0 

(29) 

After adding the following constraints, the Shannon bound remains the same. 


H{X4,X2,X3) = HiXi) + H{X 2 ) + H{X3) 

(30) 

H{X4, X 3 , Xe) = H{X4) + H{X 3 ) + H{X 3 ) 

(31) 

After checking with ITIP/Xitip, we obtain these additional functional relationships: 


H{X4\X4,X3)=Q 

(32) 

H{X3\X4,X2,X3)=Q 

(33) 

H{X 3 \X 2 ,X 3 )=Q 

(34) 

The Shannon bound will be changed if we add 


H{X4) = H{X 2 ) = H{X3) 

(35) 

H{X4) = H{X3) = HiXe) 

(36) 

After checking with ITIP/Xitip, we find that the following constraints can be added without changing the Shannon bound. 

H{X 3 ) = 2iJ(Xi) 

(37) 

HiXi) = H{X 2 ) 

(38) 

H{X 3 ) = 2H{X4) 

(39) 

H{X4) = H{Xe) 

(40) 

From these constraints, we see that the information rates on the edges from S to R and R to D are 

not identical any more. 

The coding scheme is constructed as follows: Split X 3 into (X 31 , X 32 ) and X 3 into {X 31 , X 32 )- 

1. Independently generate three bits of key Ki, K 2 and K 3 and one bit of message M from F^; 

2. on edge ei, Xi = M + Ki + K 2 + K 3 ; 

3. on edge 62 , X 2 = Ki; 

4. on edge 63 , X 31 = K 2 and X 32 = K 3 ; 

5. at intermediate node R, (M, Ki, K 2 , K 3 ) can be easily recovered; 

6 . on edge 64 , X 4 = Xi + X 31 = M + Ki + 2 K 2 + K 3 ; 

7. on edge 65 , X 31 = Xi + X 2 + X 31 = M + 2Ki + 2 K 2 + K 3 and X 32 = + X 2 + 2^32 = 

8 . on edge 63 , X 3 = X 2 + X 31 = Ki+ K 2 ; 

M + 2Ki+ K 2 + 2 K 3 ; 
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9. at the destination node D, (Xi,X 2 ,X 31 ,X 32 ) can be recovered by Xi = X 51 — Xq, X 2 = X 51 — X 4 , X 31 = Xq — 
X^i + X 4 , and X 32 = X 52 + X 4 + Xq — 2 X 51 , which means {M, Ki, K 2 , K 3 ) can also be recovered. 

We now verify the security constraints. 

. Ai; J(M; X2,X4,X5) 

= /(M; X2, + X31, + X2 + X31, Xi + X2 + X32) 

= /(M;X2,Xi+X31,Xi+X32) 

= if(X2,Xi +X3i,Xi +X32) - iI(X2,Xi +X3i,Xi +X32IM) 

= H{X2,Xi + X31, Xi + X32) - H{KuKi + 2K2 + K3, K1+K2 + 2K3) 

= 0 

. A 2 : I(M; X2,X3,X6) 

= I(M;X2,X3,X2+X3 i) 

= I(M; X2,X3) 

= 0 

. A 3 ; I{M-X3,X3,Xq) 

= I{M; Xi,X3+X2+ X31, Xi + X2 + X32, X2 + X31) 

= I{M;X3,X2+X31,X2+X32) 

= 0 

. A4; I{M;Xi,X3,Xi) 

= I{M;Xi,X3,Xi+X3i) 

= I{M;Xi,X3) 

= 0 

. As; I{M;Xi,X2,Xi,Xe) 

= IiM;Xi,X2,X3+X3i,X2+X3i) 

= I{M-Xi,X2,X3i) 

= 0 


An interesting discovery is that, in ITIP/Xitip, if we set H{K) = 3H{M) together with ( 1271 1-^291) in the constraints, all the 
relationships in ( I5QI )-(I54I) and ( liZD -d^OI) are true. This means that if the ratio of the size of the key and the message is fixed to 
that prescribed by the Shannon bound, then several functional relationships between the constituent random variables in the 
problems can be uncovered. In fact, these functional relationships can help the code designer to find an optimal linear code. 
For example (Soil tells us that Xi, X 2 and X 3 must be independent in any optimal coding scheme. To the best of the authors’ 
knowledge, this observation has not been made in previous studies. 


An algorithm based on the heuristic observation above is described in Alg. |4] 


Algorithm 4 Algorithm for finding the hidden structure of coding schemes 
In ITIP/Xitip, input all the constraints from the problem setting (e.g., (EB-®)- 

1. Add the Shannon bound H{K) = cH{M) in the constraints in ITIP/Xitip, where c is the Shannon bound. 

2. Check whether 7 T(Xi,X2 ,X3) = H{Xi) + H{X 2 ) + H{X 3 ) and H{X 4 ,X 5 ,Xe) = H{X 4 ) + HiX^) + H{Xe) are true. 

3. Check the ratios of H{Xi) : H{X 2 ) : h[x 3 ) and HiXf) : HiXfj : H{Xq). One may first find that H{Xi) = ciH{X 2 ) 
and H{Xi) = C 2 H{X 3 ). To find ci such that H{Xi) = ciH{X 2 ), it is equivalent to find ci such that H{Xi) > ciH{X 2 ) 
and H{Xi) < ciH{X 2 ), which can be checked by ITIP/Xitip. 

4. Check the functional relationships between {Xi, X 2 , X 3 ) {X 4 ,X 3 ,Xq) (e.g., X 4 is a function of (Xi, X 2 ) denoted 

as {Xi,X 2 )^X 4 ). 


All the additional conditions can help us to construct an optimal linear coding scheme. 

Remark 1. In principle, to design a linear network code, it suffices to associate a vector space to each channel in the (3, 3) 
network. These six vector spaces can be discussed in the context of the linear entropic region of 6 vector spaces, namely, Lq. 
However, the theory of determining the structure of Lq is incomplete. This hampers its application to our problem. 

C. Coding is necessary 

Example 2. In the Class-I/II (3,3) network (depicted in Fig.\i^, consider the wiretap pattern A = {Ai, A 2 , A 3 , A 4 }, where 
Ai = {2,3,5}, A 2 = {1,4,5}, A 3 = {1,3,6}, and A 4 = {2,4,6}. The routing bound is equal to 3. Both of the Shannon 
bounds for the Class-I and Class-II settings are equal to 2. Next, we construct a code to demonstrate that 2 is optimal 

1. Independently generate two bits of key Ki and K 2 and one bit of message M from F^; 

2 . on edge ei, Xi = Ki; 

3. on edge 62 , X 2 = K 2 ; 
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4. on edge 63 , X 3 = M + Ki + K 2 ; 

5. at intermediate node R, (M, Ki, K 2 ) can be easily recovered; 

6 . on edge 64 , X 4 = M + 2Ki + 2 K 2 ; 

7. on edge 65 , X 5 = M + Ki + 2 K 2 ; 

8. on edge Cq, Xq = M + 2Ki + K 2 ; 

9. at the destination node D, {M, Ki, K 2 ) can be recovered by M = 2 {X 5 +Xq)— 5 X 4 , Ki = X^ — X^, and K 2 = X^ — Xq. 
We now verify the security constraints. 

. Ai; IiX 2 ,X 3 ,X 5 -,M) 

= H{X2,X3, X 5 ) - H{X 2 , X 3 , X^\M) 

= H{K 2 , M + Ki+K 2 ,M + Ki + 2 K 2 ) 

- H{K 2 , M + Ki+K 2 ,M + Ki + 2K2\M) 

= H{K 2 , M + Ki)- H{K 2 , Ki\M) 

= 0 

. A 2 : I(Xi,X 4 ,X 5 ;M) 

= H(Xi,X 4,X5) - H(Xi,X4,X5lM) 

= H{Ki,M + 2Ki + 2 X 2 , M + Ki+ 2 K 2 ) 

- H{K 4 ,M + 2Ki + 2 K 2 , M + Ki+ 2K2\M) 

= H{K4,M + 2 K 2 ) - H{K4,K2\M) 

= 0 

. A 3 ; I{X 4 ,X 3 ,Xe;M) 

= HiX4,X3,Xe) - HiX4,X3,Xe\M) 

= H{Ki,M + K 4 +K 2 ,M + 2Ki + K 2 ) 

- H{Ki,M + K 4 +K 2 ,M + 2 K 4 + K 2 \M) 

= H{K 4 ,M + K 2 ) - H{Ki,K 2 \M) 

= 0 

. A 4 ; IiX2,X4,Xe;M) 

= H{X2,X4, Xe) - H(X 2 , X 4 , Xq\M) 

= H{K 2 , M + 2 K 4 + 2 K 2 , M + 2Ki+ K 2 ) 

- H{K 2 , M + 2 K 4 + 2 K 2 , M + 2 K 4 + K 2 \M) 

= H{K 2 , M + 2Ki) - H{K 2 ,K 4 \M) 

= 0 

Remark 2. To design a secure linear coding scheme, one needs to design Xi, i = 1, 6, such that Xi, X 2 , and X^ are 

mutually independent and X 4 , X^, and Xq are also mutually independent. Since we have two bits for the key and one bit for 
the message, the information rates in a wiretap set cannot exceed two bits. On one hand, to reduce the size of key, observe 
from the wiretap set Ai that we need to ensure that X^ is a function of X 2 and X^. On the other hand, since {Xi, X 2 , X^) is 
recoverable from (X 4 , X^, Xq), the information rates of X 4 , Xq, Xq should be 3. There should be a trade-off between these 
two constraints, which may make routing sub-optimal. 

D. Distinction between Class-I and Class-II Networks 

Example 3. In this example, we show that for the same network topology and wiretap pattern, the routing bound is tight for 
the Class-II network while it is loose for the Class-I network. Consider the wiretap pattern A = {Ai, A 2 , Aq, A 4 }, where 
Ai = {1,4}, A 2 = {2,3,4}, A 3 = {1,2,5, 6}, and A 4 = {3,5,6}. The routing bound is 3. The Shannon bound in Class-I 
network is 2 and in Class-II network is 3. Next, we construct a code to show that 2 is optimal for the Class-I network. 

1. Independently generate two bits of key Ki and K 2 and one bit of message M from F^; 

2. on edge ei, Xi = M -\- Ki; 

3. on edge 62 , X 2 = K 2 ; 

4. on edge 63 , Xq = Ki; 

5. it is easy to see at intermediate node R, [M, Ki, K 2 ) can be recovered. 

6 . on edge 64 , X 4 = Ki + K 2 ; 

7. on edge 65 , Xq = M + Ki + K 2 ; 

8 . on edge cq, transmit nothing; 

9. at the destination node D, M can be recovered by M = Xq — X 4 , Ki and K 2 cannot be recovered. 

We now verify the security constraints. 

. Ai; I{X 4 ,X 4 -,M) 

= H{X 4 ,X 4 )-H{X 4 ,X 4 \M) 

= H{M + Ki,Ki + K 2 ) - H{M + Ki^Ki + K 2 \M) 
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Fig. 3. Class-I/II (3, 2) network 


= H{M + Ki,Ki+ K2) - H{Ki,K 2 \M) 

= 0 

. A 2 : I{X 2 ,X 3 ,Xi;M) 

= I{K 2 ,K^,K^ + K 2 -,M) 

= 0 

• I{Xi,X 2 ,X^,Xq;M) 

= H{XuX2,X^,Xq) - H{Xi,X2,X^,Xf,\M) 

= H{M + Ki,K 2 , M + Ki+ K 2 ) 

-H{M + Ki,K 2 ,M + Ki+K 2 \M) 

= H{M + Ki,K 2 ) - H{KuK 2 \M) 

= 0 

. A^; I{X 3 ,X 5 ,Xe;M) 

= HiXs, X5, Xe) - H{X 3 , X5, Xe\M) 

= H{Ki,M + Ki+ K2) - H{Ki,M + Ki + K 2 \M) 

= H{Ki,M + K 2 ) - H{Ki,K2\M) 

= 0 

E. Sub-optimality of routing in Class-I/II (ni,2) and ( 2 , 712 ) networks 

Example 4. The Class-II (rii, 772 j network is equivalent to the Class-II (n 2 , ni) network. For Class-I networks, the situation 
is more subtle. For Class-I/II ( 2 , 712 ) networks, experiments can show that routing is optimal when 772 ^ 3. The problem is 
still open for the case 772 > 4. In the following, we show that there exists a Class-I (3, 2) network (depicted in Fig. li]), where 
routing is not optimal Consider the following wiretap pattern A = {^ 1 ,^ 2 , 743 , 744 }, where Ai = {1,2,4}, A 2 = {3,4}, 
As = {2,5}, and A 4 . = {1,3,5}. The routing bound is equal to 3. The Shannon bound for Class-I is equal to 2 and for 
Class-II is equal to 3. Next, we construct a code to show that 2 is optimal for the Class-I network. 

1. Independently generate two bits of key Ki and K 2 and one bit of message M from F^; 

2. on edge ei, Xi = Ki; 

3. on edge 62 , X 2 = M + K 2 ; 

4. on edge 63 , Xs = K 2 ; 

5. it is easy to see at intermediate node R, [M, Ki, K 2 ) can be recovered. 

6. on edge 64, X 4 = M + Ki + K 2 ; 

7. on edge 65 , X^ = Ki + K 2 ; 

8 . at the destination node D, M can be recovered by M = X 4 — X^, Ki and K 2 cannot be recovered. 

The security constraints can be readily verified by the same approach in Examples 1 to 3. 

IV. Two Hard Examples 

In the previous sections, we have already elucidated the differences between Class-I and Class-II wiretap networks. In the 
sequel, we focus on the Class-II wiretap networks since the problem may become simpler when K is required to be recovered. 
An observation from the experiments in the previous section is that gaps between a lower bound and an upper bound in (fThl l 
exist only if 4 < |.4| < 12. For \A\ = 4,..., 12, the number of wiretap patterns where gaps exist is listed in Table II. 

For wiretap patterns in which the routing bounds are not optimal, we have constructed linear coding schemes to achieve the 
Shannon bounds by hand. This may be tedious and non-systematic. It is thus of great interest to see whether we can apply 
similar techniques to all the remaining unknown cases. When |.4| = 4, there are only 18 wiretap patterns, where all the routing 
bounds are equal to 3 and Shannon bounds are equal to 2. We can check that Shannon bounds for all these cases can be 
achieved by linear coding schemes by the method (Alg. nil in Sec. IIII-BI We present a similar coding scheme in Sec. IIII-CI 
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4 

5 

6 

7 

8 

9 

10 

11 

12 

# gaps 

18 

252 

1494 

4842 

9144 

9648 

5400 

1494 

180 


TABLE II 

THE NUMBER OE WIRETAP PATTERNS WHERE GAPS EXIST IN THE CLASS-II NETWORK 


For wiretap patterns where |^| > 4 there are instances for which optimal linear coding schemes are not easy to construct by 
hand. Next, we state some wiretap patterns to demonstrate the difficulty of these specific instances. 

Example 5. Let A = {Ai,A 2 ,A 3 , 2 I 4 , As}, where Ai = {e 2 , 64 , 65 }, A 2 = {e 2 , 63 , ee}, A 3 = {ei, 64 , ee}, A 4 = {ei, 63 , 65 }, 
and A 3 = { 61 , 62 , 64 }. The routing bound is equal to 3. By the following constraints, the Shannon bound is equal to 7/3. 


3H{K) > 7H{M) (41) 

/(M; K) = 0 (42) 

H{X 4 ,X 2 ,X 3 \M,K) = {) (43) 

if(X4,X5,X6|Xi,X2,X3) = 0 (44) 

H{M,K\X 4 ,X 3 ,X 3 ) = Q (45) 

I{M;X 2 ,X 4 ,X 3 ) = 0 (46) 

I{M-X 2 ,X 3 ,X 3 ) = Q (47) 

/(M;Xi,X 4 ,X 6 ) = 0 (48) 

/(M;Xi,X 3 ,X 5 ) = 0 (49) 

/(M;Xi,X2,X4) = 0 (50) 

The following constraints can be added without changing the Shannon bound. 

H{X4,X2,X3) = H{Xi) + H{X 2 ) + H{X3) (51) 

H{X 4 , X 5 , Xg) = H{X 4 ) + H{X 3 ) + H{X 3 ) (52) 

H{X4) = H{X 2 ) (53) 

ZH{X 3 ) = 4iJ(Xi) (54) 

H{X3) = H{Xe) (55) 

2H{X4) = H{X 5 ) (56) 

H{X4\Xi,X2,X3)=0 (57) 

H{X3\X4,X3)=0 (58) 

H{Xe\X2,X3)=0 (59) 


Since H{K)/H{M) = 7/3, we need to construct a linear code on a vector with size 10 and the bit rates on each edges 
from S to R are 3, 3, and 4 and from R to D are 2, 4, and 4, respectively. That is tantamount to a 10 x 10 matrix over F^. 
Except brute force search, we have no other choice at the moment. Since the space of the feasible solutions is huge, optimal 
linear coding schemes for this example are unknown. 

Next, an even more complicated wiretap pattern with 12 wiretap sets is studied. 

Example 6. Let A = {Ai, A2, ..., A12}, where Ai = {63,65,66}, A2 = {63,64,65}, A3 = {63,64,65}, A4 = {62,65,65}, 
A5 = {62,64,65}, Ag = {62,63,65}, Az = {62,63,65}, As = {62,63,64}, Ag = {61,65,65}, Aio = {61,63,65}, All = 
{61,63, 64}, and Ai 2 = {ei, 62, 64, 65}. The routing bound is equal to 4. The Shannon bound is equal to 19/5 by the following 
constraints. 
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bH{K) > 19H{M) (60) 

I{M;K) = 0 (61) 

H{Xi,X2 ,X3\M,K) = 0 (62) 

H{X4,X5,Xe\Xi,X2,X3) = 0 (63) 

HiM,K\X4,X5,Xe) = 0 (64) 

/(M;X3,X5,X6) = 0 (65) 

I{M;X3,X4,Xe) = 0 (66) 

I{M;X3,X4,X5) = 0 (67) 

I{M;X2,X5,Xe) = 0 (68) 

I{M;X2,X4,Xe) = 0 (69) 

I{M;X2,X3,X3) = 0 (70) 

/(M;X2,X3,X5) = 0 (71) 

I{M;X2,X3,X4) = 0 (72) 

I{M;X4,X5,Xe) = 0 (73) 

I{M;Xi,X3,X5) = 0 (74) 

I{M;Xi,X3,X4) = 0 (75) 

I{M;X4,X2,X4,X3) = 0 (76) 

life can i/iovv via ITIP/Xitip and hence prove that the Shannon bound is unchanged after adding the following constraints. 

H{Xi,X 2 ,X 3 ) = HiXi) + H{X 2 ) + H{X 3 ) (77) 

H{X4, Xs, Xe) = i7(X4) + H{X3) + i7(X6) (78) 

7i7(Xi) = 9i7(X2) (79) 

8i7(Xi) = 9H{X3) (80) 

m{X4) = 4i7(X5) (81) 

5i7(X4) = 4i7(X6) (82) 

i7(X4|Xi,X2,X3) = 0 (83) 

i7(X5|Xi,X2,X3) = 0 (84) 

i7(X6|Xi,X2,X3) = 0 (85) 


Therefore, we need to define a linear coding scheme on a vector with size 24 such that H{K) = 19 and H{M) = 5. Moreover, 
the bit rates on the layers from S to R are 9, 7, and 8, and from R to D are 8, 6, and 10, respectively. The functional 
relationships between random variables cannot be further refined. Hence, just as in Example 1, we need to split each of 
the random variables Xi, X 2 , ..., Xe (say Xi into (Xu, X12, Xigj), then by ITIP/Xitip, we can obtain more refined 
relationships between constituent random variables {X^}. Due to the number of random variables (i.e., 24), ITIP/Xitip cannot 
afford such a huge computation. The linear coding schemes are unknown. 


In principle, to find r^, one needs to find upper and lower bounds that match. Since the network model is simple, it is 
plausible that the Shannon bound is tight (i.e., it is equal to Tjf) and linear network coding schemes are sufficient. From these 
two examples, we observe that we do not have efficient methods to construct linear coding schemes to achieve their respective 
Shannon bounds in general. The only method as of now is to use a brute force search over all the possible linear network 
coding schemes over F,. The computational complexity of such a search is g" , where n is the size of the vector and q is 
the field size. In light of the number of the remaining wiretap patterns, it is intractable and computationally prohibitive if we 
simply rely on the state-of-the-art resources. Even if we can find a solution by brute force search, such a solution fails to 
provide us with an intuitive understanding of the structure of the coding scheme. Thus, one of the take-home messages in this 
paper is that information theorists need to construct new techniques and concepts to systematically achieve the Shannon bound 
using linear coding schemes. Without such techniques, it is difficult to make progress. To assist the readers of this paper to 
investigate the problem further, we have provided the data in 11241] . 


V. Conclusion 

In this paper, we have defined Class-I/II (ni, 712 ) wiretap networks and have numerically computed bounds on H{K)/H{M). 
The performances of the routing bound on various wiretap patterns have been compared to the cut-set bound and the Shannon 
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bound. Examples are constructed to show that under both decoding classes, routing is not sufficient even for a simple (3, 3) 
network. Our numerical calculations also demonstrate the differences between Class-I and Class-II networks. Our study shows 
that when |,4,| < 4 or \A\ > 12, routing is optimal. Gaps exist in other cases. In the (3, 3) Class-II wiretap network, we can 
construct a linear code to achieve the Shannon bound for some wiretap patterns. When 5 < l-AI < 12, it is an open problem 
to systematically construct optimal linear codes, though we have provided some heuristic rules. A summary on the examples 
studied is provided in Table |In] 


Example 1 

Illustrate the basic idea of code construction. 

Example 2 

Coding beats routing. 

Example 3 

Class-I Vs. Class-II. 

Example 4 

(ni,2) Vs. (2,712). 

Example 5 

A hard example where |^| = 5. 

Example 6 

A hard example where |^| = 12. 


TABLE III 

A SUMMARY OF ALL THE EXAMPLES 


Systematic coding schemes for achieving the Shannon bound are few and far between. One of the stumbling blocks for us 
to achieve the Shannon bound is our lack of a complete understanding of information inequalities. By studying the tightness 
of the Shannon bounds and their associated coding schemes on some networks with simple topologies, we may gain new 
insights that may help us to further understand H{K)/H{M) for general networks. For general Class-EII (ni, 712 ) networks, 
we have numerically computed all three bounds for all the wiretap patterns for the (ni = 3, n 2 = 3) case. We also list some 
wiretap patterns in which the determination of the optimal H{K)/H{M) is challenging. The examples stated in Sec. IIVI 
indicate that the determination of the entropic region of 6 linear vector spaces Lq cannot be sidestepped, since the solution of 
some complicated wiretap patterns may depend on Lq (see Remark [T]). Optimistically speaking, we may conjecture that the 
Shannon bound is tight in Class-I/II (ni, 712 ) networks and the bounds can be achieved by linear coding schemes. Resolving 
this conjecture is of great interest in information theory. To do so requires us to enhance both the mathematical theory behind 
information-theoretic security and to aid in numerical investigations, more sophisticated software will be useful. 
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